A computer system that boots up from a storage area network, or SAN, (a computer system in a SAN environment) has been known. In the computer system in the SAN environment, each server reads a program such as an OS (Operating System) from an external disk apparatus, which is a storage, through the SAN. Thereby, each server is booted up.
In the computer system in the SAN environment, a security function is provided to protect data of each logical unit in the storage in which the OS is installed. A WW (World Wide Name), which is a unique ID, is assigned to an FC (Fibre Channel) port on each server. In the security function of the computer system booting up from the SAN, the logical unit in which the OS is installed and the WWN of the FC port on the server are associated with each other, whereby access only from the FC port with the specific WWN is permitted.
In the computer system in the SAN environment, a variety of configurations are adopted to improve the reliability of such a computer system. For example, the computer system in the SAN environment is designed so that when a fault occurs in one server (primary computer), another server (spare computer) continues to execute a job of the faulty server. That is, the server has redundancy.
However, in the redundant configuration of the computer system booting up from the SAN, the WW assigned to the FC port of the operating computer and that assigned to the FC port of the waiting computer are different from each other. Therefore, when the primary computer is switched with the spare computer, the spare computer cannot directly utilize a software image including the OS used on the primary computer. Thus, it has been necessary to change the setting for the security function on the storage side by software for managing the SAN, or manually.
In the redundant computer system booting up from the SAN, a technique has been invented in which the software image including the OS can be directly utilized on the primary computer and the spare computer without changing the setting for the security function on the storage side (refer to Patent Document 1: Japanese Laid-Open Patent Publication No. 2007-94611). In this technique, the management server managing the computer system in the SAN environment collects and records information on the WW assigned to the FC port of the primary computer. When the primary computer is switched with the spare computer, the recorded WWN assigned to the FC port of the primary computer is set to the FC port of the spare computer, so that the software image including the OS of the primary computer can be utilized directly by the spare computer.
FIG. 15 illustrates a processing sequence by the redundant computer system booting up from the SAN.
The processing sequence illustrated in FIG. 15 is obtained by studying a SAN boot as referring to the above Patent Document 1.
When the management server instructs the primary computer to turn on the power (P51), the primary computer is powered on (P52). A BIOS executes a POST (Power Of Self Test) (P53). The POST by the BIOS is a series of diagnostic tests executed when powered on, or when a hardware reset is executed on the computer system. Meanwhile, in this case, the waiting computer is in the power-OFF condition (P54).
The management server starts a server program for a network boot (P55), and the primary computer executes the network boot from the management server (P56). In this case, the following is the boot priority order in the primary computer: 1) the network boot, and 2) the SAN boot.
The management server delivers a setting program for the WWN to the primary computer (P57), and the primary computer collects information such as the WWN, and changes the setting for the priority order of the network boot/the SAN boot (P58).
The collected information is notified to the management server. The management server generates a management table of the WWN based on the collected information (P59).
The primary computer re-boots, executes the POST by the BIOS (P510), and starts the user OS with the SAN boot (P511). In this case, the following is the boot priority order in the primary computer: 1) the SAN boot, and 2) the network boot.
After that, a fault occurs in the primary computer (P512), and the primary computer is stopped (P513).
When the management server detects the event of a fault of the primary computer (P514), the management server instructs to the spare computer to turn on the power (P515). The spare computer is powered on (P516), and the BIOS executes the POST (P517).
The management server starts the server program for the network boot (P518), and the spare computer executes the network boot from the management server (P519). In this case, the following is the boot priority order in the spare computer: 1) the network boot, and 2) the SAN boot.
The management server delivers the setting program for the WWN to the spare computer (P520), and the spare computer sets information such as the WWN, and changes the setting for the priority order of the network boot/the SAN boot (P521).
The collected information is notified to the management server. The management server updates the management table of the WWN based on the collected information (P522).
The spare computer re-boots, executes the POST by the BIOS (P523), and starts the user OS with the SAN boot (P524). In this case, the following is the boot priority order in the waiting computer: 1) the SAN boot, and 2) the network boot.
As illustrated in FIG. 15, it is necessary to start the OS two times (P56 and P511 for the primary computer, and P519 and P524 for the spare computer) to cause the managed computer (here, the primary computer and the spare computer) to start operating.
In the technique illustrated in FIG. 15, when the managed computer is terminated (before the power OFF), it is necessary to certainly return the boot priority order to an original order so that an order of the network boot becomes the first priority order.
However, when the managed computer is powered off without the network boot order being returned to the first priority in the boot priority order setting for the managed computer since the managed computer is abnormally terminated because of the software fault and so on, and when the power is turned on at the next time, the managed computer is not able to network-boot from the managing server to execute the setting program, and to control to rewrite the WWN.
A new WWN value to be set in an HBA (Host Bus Adapter) of the computer is normally stored in a volatile memory area. The factory default WW value should be a unique ID in the world. When the new WWN value is stored in a nonvolatile memory, such a problem may be induced that the WWN value is duplicated. Thus, the volatile memory area is used to store the new WWN value so that the factory default WWN value becomes effective when the power is turned off.
That is, in the technique illustrated in FIG. 15, when the managed computer is powered off without the network priority order being returned to the first priority in the boot priority order, the WWN value is returned to a factory default value, so that the managed computer can not execute even the SAN boot. Thus, the managed computer becomes unable to be managed from the managing server.
As described above, the following two problems are included in the technique illustrated in FIG. 15. That is:
A: It is necessary to start the OS twice to cause the managed computer to start operating, therefore it's time consuming to start; and
B: When the software fault occurs in the managed computer, the managing server may be unable to control the managed computer.